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REMARKS 

Applicants appreciate the detailed examination evidenced by the Office Action mailed 
March 29, 2004 (hereinafter "Office Action"), Applicants have canceled Claims 23-28 and 
36-42. Applicants have also amended independent Claim 29 to incorporate recitations from 
Claim 30, and have canceled Claim 30. Applicants have added new Claims 43 and 44 to 
depend from Claim 35, and have also added new Claims 45-52, which are computer program 
product analogs of Claims 29-35, 43 and 44, 

Regarding the non-obviousness double-patenting rejections, Applicants submit 
herewith an appropriate Terminal Disclaimer. Applicants further submit that amended 
independent Claim 29 and corresponding new independent Claim 45 are patentable over the 
cited references for at least the reasons discussed below. 

Independent Claims 29 and 45 are patentable 

Claim 29 has been amended to include recitations from Claim 30, and now recites: 

A method of anticipating a device in a networked computer system is to be 
affected by an anomaly, comprising: 

sequentially polling a plurality of devices of the networked computer system 
in a predetermined sequential order for information relating to network 
communications thereof; 

detecting an anomaly responsive to polling of a first device in the computer 
system using network-based intrusion detection techniques comprising analyzing data 
entering into a plurality of hosts, servers, and computer sites in the networked 
computer system; and 

determining a second device that is anticipated to be affected by the anomaly 
by using pattern correlations across the plurality of hosts, servers, and computer sites 
following the detection of the anomaly and prior to polling of the second device. 

New independent Claim 45 is a computer program analog of amended independent Claim 29. 

The Office Action alleges that Claim 30, which substantially corresponds to amended 
Claim 29, is obvious over a combination of U.S. Patent Application Publication No, 
2003/01 10392 to Aucsmith et aL ("Aucsmith"), U.S. Patent No. 6,1 19, 236 to Shipley 
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("Shipley") and U.S. Patent No. 5,710,885 to Bondi ("Bondi"). See Office Action, p. 10. In 
particular, the Office Action asserts that Aucsrnith discloses all of the recitations of Claim 30 
except "analyzing data entering into a plurality of hosts, servers, and computer sites" and 
polling of a plurality of devices "in a predetermined sequential order," See Office Action, pp. 
4 and 10. The Office Action asserts "Aucsrnith and Shipley don't expressly mention the 
plurality of devices are polled in a predetermined sequential order" but asserts that Bondi 
provide such teachings and that it would have been obvious to combine Bondi with Aucsrnith 
and Shipley "since one would have been motivated to prevent the unauthorized intrusion in 
the computer networks [Shipley, col. 1 lines 15-16]." Office Action, pp. 10 and 11. 
Applicants respectfully disagree. 

To establish a prima facie case of obviousness, the prior art reference or references 
when combined must teach or suggest all the recitations of the claims, and there must be 
some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. M.P.E.P. §2143. The mere fact that references can be combined or 
modified does not render the resultant combination obvious unless the prior art also suggests 
the desirability of the combination. MJP.E.P. §2143.01, citing In re Mills, 916 F.2d 680, 16 
U.S.P.Q.2d 1430 (Fed. Cir. 1990). Evidence of a suggestion, teaching, or motivation to 
combine must be clear and particular, and this requirement for clear and particular evidence 
is not met by broad and conclusory statements about the teachings o f references. In re 
Dembiczak, 50 U.S.P.Q.2d 1614, 1617 (Fed Cir. 1999). There must be particular evidence 
from the prior art as to the reason the skilled artisan, with no knowledge of the claimed 
invention, would have selected these components for combination in the manner claimed. In 
re Kotzab, 55 U.Si\Q.2d 1313, 1317 (Fed. Cir. 2000). 

The Office Action cites column 3, lines 31-40 of Bondi as allegedly teaching polling 
in a predetermined order. See Office Action, p. 10. This passage merely describes an 
ordered transmission of polling messages, so the proposed combination of Aucsrnith, Shipley 
and Bondi would not disclose or suggest "determining a second device that is anticipated to 
be affected by the anomaly by using pattern correlations across the plurality of hosts, servers, 
and computer sites following the detection of the anomaly and prior to polling of the second 
device" as recited in Claim 29, or corresponding recitations of Claim 45, as Bondi and the 



In re: Jeffrey A. Aaron et al. 
Serial No.: 10/811,585 
Filed: March 29, 2004 
PageS 



other cited references provide no teaching or suggestion of timing relationships between 
anomaly identification as described in Aucsmith and polling as described in Bondi. 
Accordingly, even if combined, the cited references do not disclose or suggest all of the 
recitations of independent Claims 29 and 45. 

Moreover, the Office Action fails to provide the requisite evidence of a motivation or 
suggestion to combine the references. The cited evidence for combining Bondi with 
Aucsmith and Shipley (Shipley) col. 1 lines 15-16) merely indicates that it is desirable to 
prevent unauthorized intrusion, but provides no teaching or suggestion that techniques such 
as those described Aucsmith and Shipley could be modified to include polling as described in 
Bondi to provide such a result. Accordingly, the Office Action also fails to provide the clear 
and particular evidence from the prior art of a motivation to combine the cited references 
required to support a prima facie case of obviousness under 35 U.S.C. § 103, For at least the 
foregoing reasons, Applicants submit that independent Claims 29 and 45 are patentable. 

The dependent claims are patentable 

Applicants submit that dependent Claims 30-35, 43, 44 and 46-52 are patentable at 
least by virtue of the patentability of the respective ones of independent Claims 29 and 45 
from which they depend. Applicants further submit that several of the dependent claims are 
separately patentable. 

For example, Claim 44 recites "wherein determining a second device that is 
anticipated to be affected by the anomaly is followed by comprising sending an alert to the 
second device prior to polling of the second device. 11 Claim 52 includes corresponding 
computer program product recitations. As noted above, the cited references, whether taken 
alone or in combination, do not disclose or suggest specific recited relationships between 
polling and detection of anomalies and, for at least similar reasons, the cited references also 
do not disclose or suggest the specific timing relationships between polling and alerts recited 
in Claims 44 and 52. For at least these reasons, Applicants submit that Claims 44 and 52 are 
separately patentable. 
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Conclusion 

As all of the claims are now in condition for allowance, Applicants respectfully 
request allowance of the claims and passing of the application to issue in due course. 
Applicants urge the Examiner to contact Applicants' undersigned representative at (919) 854- 
1400 to resolve any remaining formal issues. 
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